Open API >Payment >Cardholder Account Management Service For Issuers
Cardholder Account Management Service For Issuers
Payment Developer Issuer Mobile Payment Internet Payment
UnionPay Cardholder Account Management Service (CAMS in short) provides a convenient way for cardholders to distribute and manage their payment credentials.
API Introduction
API Introduction
What is it?

Cardholders do not need to link cards on the digital wallet or on-line (Card-On-File) merchants. Based on Token technology, under the premise of ensuring cardholders' information security, token will be pushed to these merchants and be managed direclty in Issuer App, greatly improving cardholder's payment experience. The functions mainly include: (1) TR List Inquiry; (2)  TOKEN_CREATION_NOTIFICATION; (3) Token Lifecycle Management.


Key Features

• Simplify binding card by initiating this process from issuers' App

• Avoid card information exposure and keep account confidential

• Encourage payment participation by extensive and convenient access to more third party apps


When to Use it?

Applicable to Issuers who want to integrate UPI Cardholder Account Management Service and provide account management service to their customers.

Who Use it?
Issuers and Technical Service Provider
Where to Use it?
This API is available globally except for mainland China.
Things to Know

1. The App or website shall be provided by issuer for cardholders to initiate the token push and management.

2. Token Requestor (TR) indicates the party which stores the cardholder's token and initiates transaction with cardholder's token, such as e-wallet。

3. There are typically two types of TR, digital wallet and online merchant. The former one connects to UnionPay Mobile Payment System (UMPS), the latter one connects to UnionPay Online Payment Platform (UPOP).

4. UPI CAMS supports 3 scenarios of Issuer-TR interaction: App to App, App to Web, Web to Web. All these 3 scenarios are realized through URI method. When issuer gets the TR list from UnionPay, each TR will have 3 URI address, for iOS, Android and Web respectively. The url scheme shall be complex enough to avoid confliction with other App.

5. To ensure use experience, UnionPay recommends Issuer App to skip android/iOS scheme address first. Skip to website url happens only if the TR App is not installed on the device.

6. Sensitive information (such as Primary Account Number, PAN) is required to encrypt before transmitting it in the message.


Flow Chart
Flow Chart

Business Procedure.png

API Document
API Document
  • Linking Card
  • TOKEN_CREATION_NOTIFICATION
  • APP_LIST_INQUIRY
  • Persodata Download
Interface description
Linking Card interface is used to push card binding information from issuer app to third party app.
Request Method
HTTP POST
Request Parameter
Field name Identifier Type Length Request Default value Note
Message Type msgType string 1-64 M-Must provisionRequest provisionRequest
Message ID msgID string 1-128 M-Must 1201805140834000000 Message ID
Encrypted Data encryptedData string 1-2048 C-Condition Example in plain text: {“pan”:”6250948200000004”,”expiryDate”:”12/22”} The encrypted ciphertext of pan and expiry date which are encrypted by the encryption certificate assigned by UMPS to the Issuer. Either encryptedData or parentToken appears, and the parentToken is plaintext when it appears.
Parent Token parentToken string 16-19 C-Condition Token from Issuer which will be used by TR to apply for a token. Either encryptedData or parentToken appears, and parentToken appears in plaintext when it appears.
Jump URI jumpUri string 1-256 M-Must Jump URI. Provided when the APP is registered as TR to access UnionPay network (scheme or H5 address)
Issuer ID issuerid string M-Must 47090344 Issuer IIN assigned by UnionPay
Card Type cardtype string 1 M-Must 1 Bank card account type. 1 credit card, 2 debit card
Masked Pan maskedPan string 16 M-Must 62111111****8588 Card tail number, used to show the user the card information to be bound. Format: first 8 digits+****+last 4 digits
User Name userName string 1-32 C-Condition 张*三, T*m, *伟 The cardholder's name (some characters are hidden), used to show the cardholder the information of card to be bound. Mandatory if the initiatorCountrycode is 156
User Phone Number userPhoneNumber string 1-32 C-Condition 139******11 The cardholder's mobile phone number (some numbers are hidden), used to show the cardholder the information of card to be bound. Mandatory if the initiatorCountrycode is 156
User Information Hash Value userInfoHash JSON Object M-Must User information hash value, including ID, name and mobile phone number
Hash Algorithm hashAlgorithm string 2 M-Must Cross broad SHA-256, Domestic SM3 Hash algorithm. 00:SHA256, 01:SM3
User ID Hash userIdHash string 1-32 C-Condition the hash of the user id User id hash. Mandotary when the initiator is a domestic issuer(country code 156)
User Name Hash userNameHash string 1-32 C-Condition the hash of the user name User name hash. Mandatory if the initiatorCountrycode is 156
User Phone Hash userPhoneHash string 1-32 M-Must the hash of the user mobile phone number Mobile phone number hash recorded in the Issuer. Country code shall be added when hash the number and “-” shall be used between the country code and the mobile phone number. Example: China Mainland mobile phone number:137612345678, the value before hash should be: 86-13712345678; HK mobile phone number: 87654321, the value before hash should be: 852-87654321
Callback URL callBackUrl string 1-128 M-Must Bank APP callback notification address, used to return the result after the TR token application succeeds
Initiator Information initiatorInfo JSON Object M-Must Initiator app information, in the doc, it refer to Issuer APP
Initiator Name initiatorName string 1-128 M-Must Format: “issuer name-APP name”, two names are separated by “-”; Example: xxx bank-xxxx Initiator app name
Initiator Country Code initiatorCountrycode String 3 M-Must 344 Hong Kong; 156 Mainland China Country code of the initiator. It shall correctly indicate the country of the initiator.
Initiator Wallet ID initiatorWalletID string 8 C-Condition Initiator app walletID which is assigned by UMPS. Mandatory if the initiatorCountrycode is NOT 156
Initiator TRID initiatorTrid string 11 C-Condition 62000001111 Initiator app TRID. Mandatary if the initiatorCountrycode is 156
Token Sub Type tokenSubType String 1-100 M-Must List of tokenSubType in which the Token is allowed: "QRC"; "HCE"; SE"; "COF".
Record ID recordID string 1-128 M-Must The random number generated by the initiator app, appears during card linking
Selected App Wallet ID selectedAppWalletID string 8 C-Condition Third-party app WalletID
Selected TRID selectedTrID string 11 C-Condition Receiver app's TRID
Selected App Information selectedAppInfo JSON object M-Must Third-party app information
Signature Information signatureInfo JSON object M-Must Third-party app signature and encrypted information
Signature Certificate ID signatureCertID string 1-128 M-Must The private key certificate ID of the initiator app
Signature signature string 1-2048 M-Must Encrypt the message with the private key of the initiator app
UMPS Encryption Certification ID umpsEncCertID string 1-128 C-Condition The encryption certification ID assigned by umps to initiator app, must appear when encryptedInfo appears
Synchronous Response parameters
Filed name Identifier Type Length Request Default value Note
Message Type msgType string 1-64 M-Must provisionRequest provisionRequest
Message ID msgID string 1-128 M-Must 1201805140834000000 Message ID
Response Code respCode string 2 M-Must 0 Response code
Response Message respMsg string 1-128 M-Must Response information
Steps to Launch
Steps to Launch

Issuers and Token Requestors shall fill in the UPI Cardholder Account Management Service Application Form.


Please submit order in Support Center to contact us.


  • Contact Us
  • If you have any further questions, please register and submit order in your user center.